Actel RTAX-S Series FPGAs 


m a e a ?, ource of Acquisition 
NASA Goddard Space Flight Center 


The Actel RTAX-S is a new series of antifuse-based FPGAs now being shipped. A qualification package was submitted to 
DSCC in October 2005. The related AX series FPGAs (commercial, industrial, military) have been in production since 2003. 


Problems: 

While initial radiation testing showed 
expected supply current levels, subsequent 
Actel radiation testing with updated silicon 
and design software detected anomalous 
currents. 

The onset of the problem is thought to be 
a result of the change in the RTAX-S design 
software. Regression tests suggest that 
this problem is not a result of any silicon 
issues. This class of problem, early in the 
product cycle, is consistent with that seen 
on the previous two generations of FPGAs, 
and was solved by an update to the design 
software. 

Issues/Concerns: 

The Actel RTAX-S is a new series of 
antifuse-based FPGAs. 

The previous generation of parts 
(RT54SX-S) had reliability issues with the 
programmed antifuse. 



RTAX2000S FPGA 

Parts: RTAX250S, RTAX1000S, RTAX2000S 
Manufacturer: Actel Corporation 
Foundry: UMC, 0.15 pm 


MISSION IMPACT 


Continued 

Mission 

Critical 

Usage 

GSFC 

Project 

Project Usage 

Contingency Plan 


LRO 

C&DH system, S-Comm, Ka- 
Comm, HK/IO, and mass storage 
boards 

ASIC (aggressive schedule and 
significant budget impact) 


LOLA 

Analog and DU boards 

Actel Act 3, Xilinx Virtex, and one 
ASIC 

S 

JWST 

ISIM/C&DH, IRSU, NIRCAM, and 
NIRSPEC 

ASIC (Honeywell, BAE, and Aeroflex 
to be assessed) 


HST 

Express 

Pallet 

Mission 

Sensor Interface Module and 
Mass Storage Module 

Xilinx 

In addition to GSFC projects, these parts are also being used for various other NASA, JPL, and DoD missions. 
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Actel RTAX-S Series FPGAs 


KEY TESTING AND RESULTS 

1. Qualification Reliability Testing: In addition to the Actel “standard” qualification burn-in, Actel 
has added a second test vehicle, based upon NASA Office of Logic Design work, dedicated to 
testing the stability of the programmed antifuse. 700+ parts were tested with 1 significant failure 
(random defect). 

2. Lot Specific Reliability Testing: Using the same programmed antifuse test pattern used for 
device qualification, samples from each production lot will be tested by Actel. 

3. Radiation Testing: Actel radiation testing for total dose and single event effects shows 
adequate performance for the listed missions, with the one outstanding item being the 
anomalous currents described on sheet 1 of this document. This issue must be resolved and is 
being actively worked by Actel. NEPP sponsored testing shows results consistent with Actel’s. 

4. DPA Testing: NASA Office of Logic Design and Code 562 have sent 6 devices, two of each of 
the three models, to Hi-Rel Laboratories for a destructive physical analysis (DPA). The 
RTAX250S and RTAX2000S device sets both passed. An issue with the bond wires of the 
RTAX1000S was detected. The devices were from an early test lot, and Actel and NASA are 
investigating this issue. Additional samples will be tested and corrective actions will be 
implemented, as needed, as this class of packaging/assembly problem is routinely fixable. No 
residual risk is expected. 


RECOMMENDATIONS 

1 . Perform Additional Reliability Testing: NASA testing can complement vendor data and 
can accelerate understanding the reliability of parts. The NASA Office of Logic Design and 
the GSFC Parts Branch have developed such a test plan with inputs from JPL and other 
industry partners. 

2. Perform Additional Radiation Testing: Actel, Code 561 , and the NASA Office of Logic 
Design plan to continue radiation evaluations of these devices, for both single event effects 
and total ionizing dose. 

3. Lot Specific Reliability Testing and Procurement: RTAX-S parts shall be procured to 
Mil-Std-883 Class B Flow, which is the traditional GSFC approach. Risk is mitigated in two 
ways. First, read and record data for each flight device will be obtained and reviewed, 
screening outliers from the flight part population. Secondly, a NASA Office of Logic 
Design/Parts Branch designed “Mini Lot Qualification” will be performed on each 
procurement lot, subjecting a sample of devices to accelerated tests. 

4. Lot Specific DPA: Actel will cross section two dice from each wafer to assess antifuse 
construction. NASA GSFC Parts Branch will have DPA performed on two samples of each 
procurement lot, per standard practice. NASA Office of Logic Design will collect DPA and 
failure reports from all participating users. 

5. Design Guidelines: Designs shall meet the requirements of 500-PG-8700.2.7, “Design of 
Space Flight Field Programmable Gate Arrays.” 

6. Flight Part Programming: Flight parts will be programmed at Actel, permitting trending of 
high volume, well-maintained equipment, operated by experienced technicians. 

7. Operating Hours: All FPGAs will have a minimum of 1000 hours of operation prior to 
launch. 


Project Parts Engineer Guidance: Actel Field Programmable Gate Array (FPGA) 

Dr. Kusum Sahu 
Associate Head, Code 562 
10/29/2004 

Purpose 

The purpose of this paper is to provide an overview of the Actel field programmable gate array (FPGA) 
issues and investigations to date, provide information to GSFC parts engineers on the risks associated 
with the use of these parts in flight, provide procurement options for their respective projects, and 
provide general guidance for use of these devices if no other acceptable options exist. 

Background 

Actel Corporation FPGA devices are used in nearly all flight programs today. Most of the currently 
used devices have been produced at MEC (Japan), while newer versions are being produced at UMC 
(Taiwan). Several programs have experienced assembly-level failures of MEC programmed devices, 
causing concern with the use of these devices in high-reliability space flight applications. Some of these 
failures have been attributed to exceeding the electrical specifications of these devices, while others 
have been attributed to flaws in the programming algorithms applicable at that time. There is a good 
chance that lack of calibration or bad programming equipment also contributed to the observed failures. 
An industry-wide tiger team (ITT) has been formed to investigate these failures and determine the 
suitability of these parts for flight. The analysis and experimentation continue and will continue into the 
near future. 

The ongoing GSFC affected missions include the GLAST, JWST, NPP, Themis, AIM, SWIFT/BAT, 
and Aquarius missions. The affected missions must decide whether to stay with the MEC components 
they have, use newly designed UMC FPGAs that have not accumulated flight data, use another FPGA 
family from Actel, Aeroflex, Xilinx etc, redesign with other technologies (i.e., ASICs), or work a 
hybrid of the various options. 

To date, the Swift project has decided to launch with MEC parts after extensive analysis of test data, 

1500 hours of successful ground operation and redundancy. SDO and GLAST, who are in the 
procurement phase, have decided to switch from MEC to UMC parts and issued purchase orders. AIM is 
planning to make their decision to procure UMC parts. Also, based on the failures of MEC parts seen in 
ITT testing, Aerospace has recommended to U.S. Air Force not to use MEC parts. 

Discussion 

The Actel FPGA issue is very serious, and there is no risk free solution at this time. MEC parts cannot 
be considered as high-reliability parts because of their demonstrated failure rates; more details 
concerning the risks can be found in enclosure (1). UMC parts cannot be considered as high-reliability 
parts because of their unverified reliability by independent authority ( ITT, Aerospace, and Office of 
Logic Design at GSFC etc.) and lack of flight heritage as detailed in enclosures (2 and 3). 

Rather than mandate an across-the-board solution, GSFC has decided to allow each affected project to 
decide how to proceed with consultation from the GSFC parts engineering organization, resident parts 
specialists, and the Office of Logic Design (OLD). Details of the ongoing experimentation can be found 
on the OLD Web site (enclosure 4). 
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Recommendations 

The following recommendations are provided to aid each project in making a decision towards ensuring 

the appropriate application of these parts. 

1. Project engineers shall ensure that their designs comply with parts specification limits, application 
notes and guidelines provided by Actel, as well as follow the design rules at OLD website @ 
http://www.klabs.org/ (enclosure 4). 

2. Latest programming algorithm shall be used for either the MEC or UMC devices. 

3. Actel FPGAs shall accumulate 1,000+ cumulative hours of device (whether MEC or UMC) 
operation after programming and assembly before launch to identify and remove most parts that 
have defective antifuses. However, this requirement is not sufficient to provide reliability for parts 
used in violation of Actel’ s specification limits and application guidelines. 

4. Projects shall perform destructive physical analysis (DP A) on all flight lots focusing on the device 
construction, registration, and antifuses. 

5. Projects should consider other companies’ FPGAs (e.g., Aeroflex) as part of their decision analysis. 

6. For projects that have not yet procured flight FPGAs from Actel, FPGAs are recommended from the 
UMC foundry, and independent verification on UMC parts shall be performed. Caution: Projects 
shall consider alternative designs (e.g., ASICs) as a backup to mitigate schedule and technical risk, 
should ongoing/future tests identify reliability issues with UMC parts. 

7. New projects that are in the design phase should accommodate MEC parts and their power- 
sequencing requirements, as the MEC parts can be replaced with UMC parts or ASICs. UMC 
designs can only be replaced with ASICs; again, other FPGAs are available, but they must be 
qualified. 

8. For the long term, GSFC needs the ability to fully inspect these devices for future missions. It is 
important to extend the collaborative relationship with Actel to gain more insight into the 
construction, physics, and reliability of the newer FPGAs. More stringent controls are needed until 
Actel demonstrates that they are providing a high-reliability device that meet projects application 
needs and reliability requirements. 
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Enclosurel: MEC RT54SX-S family 

The MEC 0.25 pm foundry in Japan provides the majority of the RT54SX-S family of devices. MEC 

devices have demonstrated antifuse failures during actual use, as well as in independent industry 

evaluation and test. Key details for MEC die are as follows. 

• The MEC process for RT54SX-S devices is 0.25 pm, five-level metal. This is a radiation-tolerant 
process; radiation-hardened parts are not available. Actel does not maintain wafer-level lot-specific 
traceability for these parts. 

• MEC parts have been found to be sensitive to noise on the core voltage lines or temporary 
undershoot on the I/O due to large number of simultaneous switching. Both can cause electrical 
overstress on programmed fuses, and shall be avoided as per application guidelines from Actel and 
OLD. 

• Programming MEC FPGAs with old algorithms resulted in possible damage to antifuse from 
overheating during the programming operation. Actel is incorporating new antifuse design in newer 
version parts made at UMC. 

• Evaluation of ITT parts has found registration/alignment issues in one lot of parts supplied for test. 
Actel indicates that an internal screen was not performed in order to expedite delivery. The internal 
screen would have been performed to an LTPD of 30. It is not clear whether this small sample size 
(8[0]) would have been sufficient to identify the problem. Actel indicates that it has now increased 
the internal sampling, as well as QML qualification (life) sample sizes. 

• ITT tests of the MEC die FPGA included 600 parts. Results of the test were 25 early failures, 4 
failures before 600 hours, and 1 final at 2,100 hours, which suggests that infant mortality of the 
MEC device continues to decrease with increasing operating hours. 

• GSFC has performed analysis on the specific set of data provided by the ITT on MEC parts. Failure 
data appears to show two populations of parts, with two different failure modes, and two different 
failure rates. One population has an approximate 4% to 6% failure rate. The other population has 
shown no failures out to more than 3,500 hours. 

• The most notable project affected by MEC parts usage at GSFC is SWIFT/BAT. The project 
decided to fly SWIFT as is due to extensive analysis of test data, the instruments design, and 1,500 
hours of successful operation and redundancy. SWIFT/BAT uses a primary and secondary box 
requiring the use of 1 0 Actel parts. Based on aerospace probability analysis as applied by Dr. 
Henning Leidecker of Code 562, the reliability for a 2-year mission is 92%. 

• Evaluation of a device removed from a SWIFT project flight assembly has identified carbon (and 
other) contamination and intermetallic formation between the wire bond and die pad, beyond that 
expected for a QML device. Further investigation on additional devices continues. 

• Another GSFC project, STEREO, had a 1 out of 80 failure at 700 hours. This failure is still being 
evaluated. 

• MEC parts having demonstrated a failure rate of ~4% to 6% in ITT testing, as well as various 
contamination and alignment issues in several parts, should not be considered as high-reliability 
devices. This failure rate may negatively impact instrument/spacecraft reliability. 

• New procurements for the RT54SX-S (MEC) family of devices are not recommended. New 
procurements should be changed to the RT54SX-SU (UMC) family whenever possible as the 
preferred device due to specified (but unverified) performance improvements. See the UMC 
details in enclosure 2. 
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Enclosure 2: UMC (0.25 pm Design) - RT54SX-SU family 

The UMC 0.25 pm foundry in Taiwan supplies the newly released RT54SX-SU family of devices, as 

well as the majority of the commercial-grade devices. UMC devices have not demonstrated any antifuse 

failures during the normal QML qualification process. Reliability data are provided by Actel 

Corporation only, and have not been independently verified to date. 

Key details for UMC die are as follows. 

• UMC process for SX-SU devices is 0.25 pm, seven-layer metal. This is a radiation tolerant process; 
radiation-hardened parts are not available. The lot identification number on the package bottom side 
begins with a D. Actel does not maintain wafer-level lot-specific traceability for these parts. Actel 
indicates that, in the future, it will be implementing a new tracking system that will make this 
traceability information available. 

• QML status was received in September 2004 for 54SX-SU families of devices. These parts are 
available to DSCC SMD 5962-01508 and 5962-01515, dash numbers 05-08. 

• The UMC process implements a purported improved antifuse structure (per Actel) when compared 
with the MEC process. 

• The RT54SX-SU family has been redesigned to eliminate the inrush current issues and power 
sequencing requirements of the RT54SX-S family. This simplifies power supply circuitry necessary 
to support these devices. This is a major performance improvement (unverified). 

• Only the latest software revision of Silicon Sculptor II (v4.46.0 for Win) is compatible with the 
RT54SX-SU family of devices. 

• The current lead-time estimate for QML-Q devices is 1 8 weeks. 

• ITT independent evaluation of devices with the same antifuse structure, from the same foundry 
(though not the RT54SX-SU device), is underway. Results are expected within 6 weeks. 

• This is a new device family, redesigned from the RT54SX-S family. As such, there is no 
existing flight heritage or independent reliability verification data. Because of this inherent 
risk, projects may want to design for MEC die (known failure rate, power sequencing, inrush 
current circuitry), in the event that ITT evaluation results are negative, or explore other 
options such as ASICs or other vendor’s FPGA. 
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Enclosure 3: UMC (0.15 pm Design)- AX family 

The UMC foundry in Taiwan will also supply the newest 0.15 pm RTAX families of devices, due to be 

introduced as QML products in 2Q05. Prototype devices from this family are available now, but QML 

qualification has not been completed. 

Key details for the RTAX die are as follows. 

• The UMC process for RTAX devices is 0. 1 5 pm, seven-layer metal. 

• This family does not support 5 V I/O; 3.3 V is the maximum, and 1.5 V, 1.8 V, and 2.5 V I/O are 
also available selections. 

• Pre-production units are available now; QML devices are expected in 2Q05. The SMD specification 
has not been released. QML qualification testing has not been completed by Actel. Product delivery 
schedule may be delayed due to QML qualification test issues, impacting program schedule. 

• First part deliveries are being offered in ceramic quad flat packs (CQFP), with limited I/O 
availability - thereby restricting the design and gate usage number. 

• The largest devices are available as ceramic column grid array (CCGA) packages, which may 
present previously unseen assembly issues. 

• FIFO controller and SRAM circuitry on the RTAX die are not radiation hardened. ED AC and other 
mitigation strategies may be required to meet project radiation requirements. 

• At this time, there is no ITT testing planned for this device family. 

• This series of devices needs independent qualification to assure their reliability for space 
applications. 

• Radiation characterization data on flight parts is needed to determine the suitability of parts to each 
mission requirements. 

• This is a new device family. As such, there is no existing flight heritage or independent 
reliability verification data. Programs using these devices incur risk to cost and schedule 
associated with the introduction of any new, untested product. 
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Enclosure 4 : Application Guidelines for All Actel FPGA Devices 

Users shall diligently follow the published Actel design guidelines and application notes. Concrete 
evidence of the negative effects of improper design and application of Actel FPGAs is available, and 
continues to accumulate; hence, the need for more attention is emphasized here. Below are key design 
and application criteria that affect all Actel FPGA products, regardless of the die foundry. These are 
repeated here for emphasis; all are described within the Actel application notes and design guidelines 
documents, as well as on the GSFC Office of Logic Design (OLD) Web site (http://www.klabs.org/). 

1 . Recommended operating conditions should be observed in the flight use of these devices. Use of the 
parts beyond the published Actel data sheet (and/or DSCC SMD 5962-01508 or 5962-01515 as 
applicable) absolute maximum ratings is prohibited, and may be deleterious to part reliability. No 
voltage/current/timing margins, beyond that explicitly specified, should be assumed by the user. 

2. Use of programmed parts not in compliance with published Actel application notes and usage 
guidelines is prohibited. Some examples include, but are not limited to: 

a. Simultaneous switching noise and signal integrity. 

b. Power cycling and sequencing (RT54SX-S only). 

c. Cold sparing. 

d. TRST* and IEEE JTAG configuration. 

e. Clock skew and short paths. 

f. High/low slew rate output driver use. 

g. Board-level considerations (including capacitor selection). 

h. Quadrant clocks. 

3. Designs must be properly analyzed to assure that signal integrity parameters are met. Clocks and 
logic levels must be clean and glitch-free. Phase relations with other signal lines must be taken into 
account. Worst-case analyses should take into account factors such as pulse width, propagation 
delays, and jitter. Environmental and aging effects need to be assessed for their impact on 
propagation delays. 

4. Programming software should be verified to be the latest version available, prior to device 
programming. Silicon Sculptor II (Win) is currently at v 4.46.0 (as of October 14, 2004). This latest 
programming algorithm does not eliminate the low-current antifuse damage caused during 
programming, but claims to eliminate all high-current antifuse damage. Independent analysis 
continues; results are expected before then end of CY2004. A newer software version, claiming to 
eliminate both high-current and low-current antifuse failures, is expected by the end of October 
2004. 

5. Programming hardware should be maintained in accordance with the Actel instructions and Code 
562 calibration procedure (to be developed). Recommendation for calibration of hardware used to 
program flight devices is attached (Appendix A), and should be implemented immediately. 

6. Designers should consider use of JTAG (IEEE 1 149.1) circuitry in new designs. Information on 
module, device, and PWB operation, without the need for special probes or device removal, would 
enhance troubleshooting capability. 
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7. The URLs below provide link to specific topics regarding guidance in the use of Actel RTSX 
FPGAs: 

"OLD News #1: Terminators for Silicon Explorer" 
http://www.klabs.org/richcontent/old news/old news l.htm 

"OLD News #3: Input Transition Times for SX-S FPGAs" 
http://Avww.klabs.org/richcontent/old news/old news 3.htm 

"OLD News #9: Heat Sinks In Integrated Circuit Packages Can Cause Shorts" 
http://www.klabs.org/richcontent/old news/old news 9/ 

"OLD News #10: RT54SX32S High ICCI Inrush Current" 
http://www.klabs.org/richcontent/old news/old news 10/old news 10.htm 

"OLD News #13: Minimum Delays and Clock Skew in SX-A and SX-S FPGAs" 
http://Avww.klabs.org/richcontent/old news/old news 13/ 

6a. Refer to the following URL for general guidelines and Criteria for Space Flight Digital Electronics" 
http://Avww.klabs.org/DEI/References/design guidelines/nasa guidelines/ 
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Enclosure 5: Alternates To Using Actel FPGA Devices 

There are other options available to the system designer, to replace Actel FPGA devices. Many of these 

options have their own specific set of risk factors. A small, representative list is provided here. 

Additional details on these options may be provided, as required. Please contact Code 562 for additional 

assistance. 

1 . Custom ASIC Device. QML radiation-hardened devices are available. There is no specific flight 
heritage, since each design is unique; 22+ weeks must be allowed for flight devices. Each new 
“spin” (design) requires additional schedule (8+ weeks) and additional NRE. Mature design is 
required for cost efficiency. 

2. Aeroflex FPGA. QML qualification is in process and expected in December 2004. This is a 
radiation-hardened FPGA with no existing flight heritage. It uses antifuse technology, but the logic 
structure within the cells is very different from the Actel parts. There is no clear formula for Actel 
gate count to Aeroflex gate count. Design and simulation tools are commercially available (e.g., 
Quicklogic). The part is similar in price to the Actel RT54SX72S. 

3. Xilinx FPGA. This is available as a TID radiation-hardened device, but it has no SEE specification. 
SRAM-based logic allows reprogramming. Radiation effects evaluation is in process by Code 561. 
The largest devices are available only as CCGAs. 

4. FPGA to ASIC Migration. This is a hybrid approach using FPGA for breadboard, brassboard, and 
engineering models to finalize design. Finalized design is then converted to ASIC for flight 
assemblies. This option allows less expensive, commercial FPGAs for development. Costs rise if 
the design requires modification after the ASIC run begins. 
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Appendix A. Silicon Sculptor Programmer Calibration Verification Procedure 1/ 

In order to maintain the Silicon Sculptor Programmer and reliably program flight devices, two separate 
verification processes are required, as described below. The procedural information is current as of 
October 21, 2004; refer to the Actel Corporation Web site to verify the latest procedures. The 
verification intervals, as specified below, are highly recommended for maximum programming 
reliability, and to minimum unnecessary damage to flight devices. 

Calibration verification is required to be performed prior to the start of programming for a batch of flight 
devices, at a minimum. Self-diagnostic test is required to be performed prior to the start of 
programming for each flight device. 

A. Calibration Verification. It is necessary to verify the accuracy of the programmer’s self-diagnostic 
test to ensure that the test will provide accurate results. The programmer uses an internal digital volt 
meter (DVM) to measure the voltage and/or current of 13 internal nodes and 48 analog pin drivers, 
allowing verification. The internal DVM accuracy may be verified with a bench DVM. An option in 
the self-diagnostic test may be executed to allow testing of the accuracy of the internal DVM and time 
base using a bench DVM and oscilloscope or period counter. The following DVM and AC calibration 
procedures shall be performed prior to the start of each flight programming batch operation. If 
the unit fails the accuracy or self-test, it must be returned to the factory (Actel) for repair and failure 
analysis. 

Procedure for verifying accuracy of internal DVM: 

1 . Secure the SM48DB (48-pin DIP socket module) in place on the programmer. 

2. Press the ALT D keys. 

3 . Press the T key when prompted. 

4. Connect the BLACK lead of your DVM to pin 3 of the DIP socket. 

5. Measure the voltage at pins 1 and 2 of the DIP socket and check that they fall within the minimum 
and maximum levels displayed on the screen. 

6. Press any key to continue. 

Procedure for verifying AC calibration: At this point in the test, the programmer will produce a 900 ps 
pulse width on pin 1 of the DIP socket. Use an oscilloscope or period counter to verify that the positive 
pulse on pin 1 is between 890 ps and 910 ps. 

This completes the traceability test. The programmer will continue with normal self-test. It must pass 
the self-test. 

B. Self Diagnostic Test. During the FPGA programming operation, each pin driver is continuously 
monitored and calibrated by a special supervisory circuit. The programmer’s self-diagnostic test will 
verify correct operation of the pin drivers, power supply, CPU, memory, and communications. This 
self-diagnostic test should be successfully completed performed prior to the start of programming 
for each flight device. 


1/ (Reference Actel SiliSculptProgCali.pdf file) 
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